Microsoft Patch Tuesday August 2026

The August edition of the Patch Tuesday update addresses 400 vulnerabilities, including 3 zero-day vulnerabilities. According to Microsoft’s own Security Update Guide, 421 Microsoft CVEs have been reported including 44 critical vulnerabilities.

The following vulnerabilities were addressed through the update that threat actors exploited to orchestrate attacks:

3 zero-day vulnerabilities addressed – 1 actively exploited, 2 publicly disclosed

1. CVE-2026-68820 – Windows Ancillary Function Driver for WinSock – Elevation of Privilege

Microsoft has addressed one zero-day flaw in the Windows Ancillary Function Driver for WinSock (afd.sys) that is actively being exploited in real-world attacks.

The flaw is a use-after-free flaw in a Windows kernel-mode driver used by the Windows Sockets API. An attacker with initial local access to a vulnerable system can exploit this flaw to execute codes with SYSTEM-level privileges, gaining extensive control over the device.

Check Point research has reported that the Lazarus threat actor is deploying the FudModule kernel-mode rootkit by exploiting the vulnerability, proving how a local privilege escalation flaw can be used to orchestrate broader intrusion.

The attackers can exploit the vulnerability to:

• Escalate privileges to administrator or SYSTEM-level access
• Gain control over Windows endpoints and servers
• Use elevated privileges to execute malicious code
• Access sensitive files, credentials, system information, and tokens
• Disable/tamper with security controls
• Establish persistent access to compromised systems
• Move laterally across the network through compromised systems
• Steal sensitive corporate or customer data
• Deploy malware or ransomware
• Use the compromised system to further orchestrate broader attacks

2. CVE-2026-62832 – Windows User Profile Service – Elevation of Privilege 

A publicly disclosed elevation-of-privilege vulnerability in Windows User Profile Service has also been addressed in the August Patch Tuesday update. The vulnerability involves improper handling of link resolution.

An attacker with local access can exploit the flaw to manipulate how Windows loads another user’s registry hive and gain elevated privileges on the affected system. Microsoft has flagged this vulnerability as one that is more likely to be exploited.

The attackers can exploit the vulnerability to:

• Escalate privileges from a local low-privileged account to administrative access
• Access or manipulate another user’s registry hive
• Modify security-relevant system and user configurations
• Execute malicious code with elevated privileges
• Access sensitive credentials, tokens, and system information
• Disable or weaken endpoint security controls
• Establish persistence on compromised systems
• Deploy malware or ransomware
• Move laterally across the network
• Use the compromised system to orchestrate wider attacks

3. CVE-2026-72971 –Windows Container Isolation FS Filter Driver – Tampering 

This zero-day was a publicly disclosed tampering flaw in the Windows Container Isolation FS Filter Driver. The driver is involved in filesystem operations for Windows container isolation.

By exploiting this flaw, an attacker can modify the files and interfere with the filesystem operations inside Windows containers, potentially compromising the security and integrity of apps running in them.

Unlike CVE-2026-68820, this flaw is not actively exploited in the wild. However, since technical details were publicly disclosed, organizations that run Windows containers should prioritize assessment and remediation.

The attackers can exploit the vulnerability to:

• Modify or manipulate filesystem operations within affected environments
• Compromise the integrity of container applications and workloads
• Interfere with security or application controls within containers
• Tamper with sensitive data used by containerized applications
• Further orchestrate attacks by manipulating containerized workloads
• Create opportunities for follow-on attacks on applications or services
• Orchestrate follow-on attacks on enterprise environments

SharkStriker’s recommendations

The following are some of the security recommendations that organizations should follow:

• Prioritize patching actively exploited vulnerabilities immediately.
• Maintain an accurate inventory of Windows endpoints and servers to identify systems requiring the August updates.
• Prioritize internet-facing and business-critical systems during patch deployment.
• Ensure EDR solutions are enabled and operating correctly across Windows endpoints.
• Monitor for suspicious SYSTEM-level process creation, privilege escalation, unexpected driver activity, and security-control tampering.
• Review suspicious activity associated with malware delivery and post-exploitation activity.
• Validate patch compliance after deployment and investigate systems that remain vulnerable.
• Maintain tested backups and incident-response procedures to reduce the impact of successful exploitation.

SharkStriker’s Actions

The following are some of the actions:

• Threat intelligence validation completed.
• August 2026 Microsoft Patch Tuesday vulnerabilities reviewed for exploitation status and customer relevance.
• CVE-2026-68820 identified as the primary priority due to confirmed active exploitation.
• CVE-2026-62832 identified as a secondary priority due to prior public disclosure.
• Detection and threat-hunting opportunities identified for SOC monitoring.
• Advisory prepared for Marketing Team publication. Links to Relevant Blogs / Articles
• Microsoft Security Update Guide
• Microsoft Update Catalog Check Point Research – Lazarus / CVE-2026-68820 research
• Hunt initiated for the Operation Dream Job campaign exploiting CVE-2026-68820